fix: stop leaking metadata values into diagnostics, and salvage per key

Two credential leaks, the same class already fixed for the client logger:
`serverList` printed the malformed entry verbatim — a legacy row missing `key`
still holds whatever the user configured — and the CLI overflow error echoed
the whole `key=value` pair into stderr and CI logs. Both now name the key and
the offending *type*; a test plants a `sk-live-…` and asserts it appears
nowhere while the key still does.

`normalizeStoredMetadata` now also drops a value that parses but cannot be
sent. A hand-edited catalog is the reachable source: it is parsed server-side,
so `1e400` really does become `Infinity` there, and the next write would store
`null`. Filtered per key, matching the per-item salvage this file already does
elsewhere, so one bad value does not cost the user the rest.

Deliberately *not* added to the `/api/servers` guard, which review also
suggested. Writing that test is what showed why: a client's own
`JSON.stringify` turns `Infinity` into `null` before the request is sent, so
the wire cannot carry the bad case at all — and the check made things worse,
rejecting the whole metadata field where the normalizer drops one key. The
guard stays a container check, with a comment recording both points.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/cli/__tests__/metadata.test.ts

@@ -911,6 +911,34 @@ describe("Metadata Tests", () => {
       }
     });
 
+    it("names the key but never the value when rejecting", async () => {
+      // The pair can carry a credential, and this message reaches stderr and
+      // CI logs.
+      const server = createTestServerHttp({
+        serverInfo: createTestServerInfo(),
+        tools: [createEchoTool()],
+      });
+      try {
+        await server.start();
+        const result = await runCli([
+          server.url,
+          "--cli",
+          "--method",
+          "tools/list",
+          "--metadata",
+          'credentials={"accessToken":"sk-live-nope","n":1e400}',
+          "--transport",
+          "http",
+        ]);
+        const output = `${result.stderr}${result.stdout}`;
+        expect(result.exitCode).not.toBe(0);
+        expect(output).toContain("credentials");
+        expect(output).not.toContain("sk-live");
+      } finally {
+        await server.stop();
+      }
+    });
+
     it("should handle metadata parsing validation", async () => {
       const server = createTestServerHttp({
         serverInfo: createTestServerInfo(),

clients/cli/src/cli.ts

@@ -504,8 +504,11 @@ function parseKeyValuePair(
   // and better than falling back to the literal string, which would also not
   // be what was asked for.
   if (!isSerializableJson(parsedValue)) {
+    // Names the key, never the value: the pair can carry a credential
+    // (`credentials={"accessToken":"…","n":1e400}`) and this message lands in
+    // stderr and CI logs.
     throw new Error(
-      `Invalid parameter value: ${value}. Numbers must be finite (a value like 1e400 overflows and cannot be sent).`,
+      `Invalid value for "${key}": numbers must be finite (a literal like 1e400 overflows to Infinity and cannot be sent).`,
     );
   }